TI-2026-76687 Aliases CVE-2026-86922 GHSA-gm6q-c5mj-f444

Type confusion in Apple Safari and iOS allows code execution

MEDIUM 40CWE-843Published 2026-10-20 · Updated 2026-10-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-843 and the CVSS impact.

Summary

Apple Safari, iOS and iPadOS, macOS and visionOS are affected before version 27. A type confusion flaw (CWE-843) comes from improved state management that was addressed in these releases. Processing maliciously crafted web content may lead to arbitrary code execution, and an attacker needs a user to visit or process the crafted content, with no authentication required.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00335 27th percentileScored 2026-11-07

Fix Partial Safari (Apple): 27iOS and iPadOS (Apple): 27+2 more productsRed Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apple	Safari	before 27	27	Patch available	CNA
Apple	iOS and iPadOS	before 27	27	Patch available	CNA
Apple	macOS	before 27	27	Patch available	CNA
Apple	visionOS	before 27	27	Patch available	CNA

Safari VendorApple Affected before 27 Fixed in 27 Patch available CNA
iOS and iPadOS VendorApple Affected before 27 Fixed in 27 Patch available CNA
macOS VendorApple Affected before 27 Fixed in 27 Patch available CNA
visionOS VendorApple Affected before 27 Fixed in 27 Patch available CNA

CPE names Threatist (inferred) · 2

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:apple:safari::::::::	—	—	Apple
cpe:2.3:o:apple:visionos::::::::	—	—	Apple

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* Versions — — ·Apple
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* Versions — — ·Apple

Remediation

Apple fixes this in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27 and visionOS 27. Red Hat rates the issue Important and lists Red Hat Enterprise Linux 7 as affected with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Fix · CNA Safari (Apple) Fixed in 27
Fix · CNA iOS and iPadOS (Apple) Fixed in 27
Fix · CNA macOS (Apple) Fixed in 27
Fix · CNA visionOS (Apple) Fixed in 27

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-20
Apple macOS 27
16 records Highest priority Priority MEDIUM 1 MEDIUM, 15 LOW
Other records, highest priority first
- TI-2026-76654 Apple macOS may launch maliciously modified appsPriority LOW 38
- TI-2026-76700 Race condition in Apple iOS, iPadOS and macOS lets apps escape sandboxPriority LOW 35
- TI-2026-76686 Apple iOS and macOS permissions flaw lets attackers overwrite filesPriority LOW 27
Show all 16 records →
Release · 2026-10-20
Apple visionOS 27
14 records Highest priority Priority MEDIUM 2 MEDIUM, 12 LOW
Other records, highest priority first
- TI-2026-76685 Stack overflow in Apple iOS, macOS and visionOS allows code executionPriority MEDIUM 40
- TI-2026-76698 Out-of-bounds read in Apple operating systems can crash the systemPriority LOW 29
- TI-2026-76674 Out-of-bounds write in Apple operating systems can crash devicesPriority LOW 29
Show all 14 records →

Show 2 more groups

Release · 2026-10-20
Apple iOS and iPadOS 27
11 records Highest priority Priority MEDIUM 1 MEDIUM, 10 LOW
Other records, highest priority first
- TI-2026-76705 Incorrect authorization in Apple iOS and iPadOS may let apps place callsPriority LOW 38
- TI-2026-76700 Race condition in Apple iOS, iPadOS and macOS lets apps escape sandboxPriority LOW 35
- TI-2026-76704 Authorization flaw in Apple iOS, iPadOS and macOS exposes sensitive dataPriority LOW 24
Show all 11 records →
Release · 2026-10-20
Apple Safari 27
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-76677 Logic issue in Apple Safari, visionOS and watchOSPriority LOW 24
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 7	Affected	No fix yet

Not affected: 1 product

Red Hat Enterprise Linux 6

Timeline

2026-10-20 Threatist record created from CVE-2026-86922
2026-10-20 CVSS score added · CISA ADP
2026-10-20 Weakness changed · CISA ADP
2026-10-20 CISA SSVC decision points changed
2026-10-20 Alias added: GHSA-gm6q-c5mj-f444
2026-10-20 Affected versions changed · Red Hat
2026-10-20 CVSS score added · Red Hat
2026-10-21 CISA SSVC decision points changed
2026-10-22 Priority changed: LOW → MEDIUM
2026-11-02 Affected versions changed · Red Hat

References

Other 4

TI-2026-46583 Improper authentication in Apple macOS KEVCVSS 3.1CRITICAL 9.8
TI-2025-28008 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
TI-2025-22441 Apple iOS and iPadOS: An attacker with arbitrary read and write capability may be able to… KEVCVSS 3.1CRITICAL 9.8
TI-2025-22440 Memory corruption in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8
TI-2025-17951 Out-of-bounds write in Apple Safari KEVCVSS 3.1CRITICAL 10.0
TI-2025-17847 Use after free in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0

See all 9536 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences